Wave Race 64: unQue Shuishang Motuo

"Shuishang Motuo", aka "Wave Race 64" in other regions, uses emulated EEPROM and Controller Paks on iQue. After patching the iQue title, hardware EEPROM and controller slot devices will function on retail N64s. In addition, the Controller Pak manager is available when holding Start on boot.

The patched ROM expects either 4k or 16k EEPROM on its board; CIC is 6102. Up to four controllers, Controller Paks, and Rumble Paks are supported.

Apply the xdelta patch using the similarly named xdelta; use version 3.0.8 or up. The patch will only apply to a *decrypted* ROM in native (big-endian) byteorder.
----
This unQue patch series is directed at restoring save support and reversing library changes in iQue titles so they function reliably on retail consoles and a wider range of emulators–at the expense of breaking iQue support.

.: Introduction :.
This unQue patch series is directed at restoring save support and reversing library changes in iQue titles so they function reliably on retail consoles and a wider range of emulators--at the expense of breaking iQue support.
For the sake of emulators/flashcarts that look at GUID codes to differentiate these patches from retail titles, a GUID and timestamp were added. The device type is set to "B" for "BB Player" (not "Q"), and region to "C" for China or "W" for Taiwan/Hong Kong. Internal names are encoded using codepage 936 (normally CP 932). This information is not used by console. Bootstraps (IPL3) are swapped to match their retail counterparts; iQue does not, in fact, run this code, and many use the "development" IPL not tied to a CIC.

"Shuishang Motuo", aka "Wave Race 64" in other regions, uses emulated EEPROM and Controller Paks on iQue. Data is loaded into the top of RDRAM and flushed back later. All controller slot devices are emulated as simple reads and writes to an assigned address range. The BB Hack flags allowed mirroring the main controller to a port of your choice.

The patched ROM expects either 4k or 16k EEPROM on its board; CIC is 6102. Up to four controllers, Controller Paks, and Rumble Paks are supported.


.: Patching :.
Apply the xdelta patch using the similarly named xdelta; use version 3.0.8 or up. The patch will only apply to a *decrypted* ROM in native (big-endian) byteorder.
(The process for extracting your console's tickets and decrypting an extracted ROM are well outside the scope of this readme.)

Common Names
5101104
004DD630.z64
Shuishang Motuo.z64

Original File Checksums (Decrypted)
SHA-1
19C2E84440EBEC5B6A349EC96CDC629E03491A19
SHA-512
AB0E8D810557BD1382C58DC4DB0A48508C303AADDAF2807C1439A07D41CA5175512C7C689412689D8F49E8AD490C6B721D454831E53950CD22865A0C6102C3BD

Patched File Checksums
SHA-1
CFBF323BDC037ABCE1B8773B6EA89B2ABECBED53
SHA-512
ADE9A89B12F9DBC27B73D3CFCA9C13842EF7E0DB6118746A1AEF9473232191CF9974D8213F900B9C1EFA7F3266CA934293B77C266F595A82AC5E698F2FBE4EBB


.: Notes :.
*) Not all changes to the standard library are reversed, only those which directly affect operation or expose iQue-specific registers to emulators (console won't be affected, but emus may throw errors). This includes rewriting system initialization, controller pak detection, and most dedicated save-related functions to some degree. Other code is already isolated when iQue hardware is not detected.
*) Unlike most of the N64 library, the game will operate properly without an EEPROM present. If your saves are not persistent, check the chip is mounted correctly or whatever settings are relevant for your emu/flashcart.
*) The EEPROM read/verify function has been moved to avoid a potential run condition. This falls in a subset of software that does unsafe things with threads. In this case, the queue that is needed for the EEPROM timer is created at the end of the controller initialization function. These lie in different threads which will be executing at the same time, so potentially the timer callback could have a NULL or invalid pointer. It's unnecessary and asking for trouble, so instead EEPROM is read at the end of controller initialization.
*) The "no controller" warning is in Chinese.
*) The Controller Pak manager is rehooked and can be accessed by holding Start on controller 1 while the game is booting. It will only appear if a Controller Pak is in controller 1; other controllers are ignored. The menu is partially localized from Japanese to Chinese.

-Zoinkity


*Common Names
5101104
004DD630.z64
Shuishang Motuo.z64
*Original File Checksums (Decrypted)
*SHA-1
19C2E84440EBEC5B6A349EC96CDC629E03491A19
*SHA-512
AB0E8D810557BD1382C58DC4DB0A48508C303AADDAF2807C1439A07D41CA5175512C7C689412689D8F49E8AD490C6B721D454831E53950CD22865A0C6102C3BD